CVE-2026-93567: Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority
HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the patched behavior in HttpConversionUtil when converting outbound HTTP/1.1 CONNECT with an authority-form request-target (host:port) to HTTP/2: omit the forbidden pseudo-headers :scheme and :path; set :authority from the HTTP/1 CONNECT authority-form request-target; set :method to CONNECT; and reject or ignore any conflicting Host header value instead of allowing Host to override the CONNECT target.
Netty HttpConversionUtil (codec-http2) HTTP/2 pseudo-header construction for CONNECT when HTTP/1 request-target is authority-form (host:port) = Do not emit :scheme and :path; set :authority from HTTP/1 CONNECT authority-form request-target; set :method to CONNECT; reject/ignore conflicting Host instead of allowing it to replace the CONNECT target
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
Prioritize deployments that use Netty's HTTP/1-to-HTTP/2 conversion for CONNECT requests. The issue is triggered when a true HTTP/1 authority-form CONNECT request is converted to HTTP/2.
What does an attacker need to exploit this behavior?
The supplied severity vector indicates network access is sufficient, with no privileges or user interaction required. Exploitation involves supplying an authority-form CONNECT target and a Host header controlled by the attacker.
How can I determine whether my conversion path exhibits the issue?
Test a request such as CONNECT trusted.example:443 with Host set to attacker.example:443, then inspect the resulting HTTP/2 headers. An affected conversion sets :authority from the Host header and also emits :scheme and :path for the CONNECT request.